https://github.com/AdamISZ/babilonia-paper
and delving post: https://delvingbitcoin.org/t/babilonia-probabilistic-coinjoin-and-covert-betting/2704
Pot sweeteners was a late addition and I think it's much more interesting because of that.
quotinghttps://mempool.space/signet/tx/2070fba2551a5702bcfbe964486692d8a5d4519bd58ae2ee2a7d6bf5aed847d4
nevent1q…hzxt
https://mempool.space/signet/tx/c9e68df6f7384bc43a4379007265ff343e8c381e7ab232e7ea9b94037598803d#vin=0
Nothing about the two transactions shown is strange. The first is 2 in 2 out, the second is 1 in, 2 out; normal payments [1]. If you examine their witness you'll see they're like 90% of other taproot transactions, just keypath, no scripts involved.
But in fact, this is a bet. Two parties flipped a fair coin for the winnings (a small chunk of the input funds). Not literally; they used cryptography to get an exactly 50% chance of winning without having to trust the other. They were both running signet nodes (in fact I had one on my laptop at home and another on a VPS), and used decoy packets in BIP324 (bitcoin p2p encrypted transport) to communicate, so no one could even know the negotiation was happening (side note: this idea feels like it should be useful in many other contexts, and it's surprisingly easy to set up, with a very simple patch to your bitcoind).
So we have a fair bet inside a coinjoin; you could think of it as a randomized payjoin if you like, but, the transfer of funds is not for some goods and services but, just a wager, and it's perfectly fair because of a cryptographic trick that was discussed on delving [2] though it's changed from what was written there.
Payments inside coinjoins break subset sum analysis; this is just another kind of payment. Amongst other virtues of such a system is that it creates economic activity between peers without middlemen which is vital to Bitcoin's general pseudonymity.
The implementation is at https://github.com/AdamISZ/babilonia . The repo is currently 95% AI-written so not very readable (still not *unreadable*, but, y'know how it is) but I have a paper that I've nearly finished that is human written and human readable for those interested in the mechanics.
[1] In fact those familiar with details of payjoins *will* see something specific about the 1st transaction that makes it like a payjoin. But it isn't hard to remove that, and anyway, it's only a watermark for 'this is a payjoin', not for what it *actually* is...
[2] https://delvingbitcoin.org/t/emulating-op-rand/1409/7
